thumbor / thumbor-plugins / 40261534209

99%

push

github

docs: add SECURITY.md with vulnerability reporting policy (#116)

Add a security policy based on the one in the thumbor repository, so GitHub
shows it on the Security tab and reporters find the private reporting flow
instead of opening a public issue. Private Vulnerability Reporting is already
enabled on this repository, so the documented steps work as written.

The text is adapted to the monorepo: each thumbor-plugins-* package is
supported at its latest release only, reporters are asked for the affected
package and the version of the wrapped binary, issues in thumbor itself or in
the upstream tools are routed to their own projects, and the deployment
advice covers the fact that every optimizer executes an external program with
thumbor's privileges using operator-supplied paths and settings.

23 of 28 branches covered (82.14%)

Branch coverage included in aggregate %.

197 of 199 relevant lines covered (98.99%)

0.99 hits per line